APEX

Hello everyone,

My APEX version is 23.1.0.

I use Tomcat as the application server in both the test and production environments.

Everything is working fine. Both test and production servers are deployed on Windows Server.

I now need to install a reverse proxy, also to hide the clear URL containing /ords/r/myworkspace/… from the user.

I chose the NGINX server. I installed it locally on my Windows PC, for the test phase, and the goal is to reverse proxy the application in the test environment.

However, I get the Too many redirects error.

Here is my nginx.conf file :

#user nobody; 
worker_processes auto; 

error_log logs/error.log; 

pid logs/nginx.pid; 


events { 
worker_connections 2048; 
} 


http { 
include mime.types; 
default_type application/octet-stream; 

#log_format main '$remote_addr - $remote_user [$time_local] "$request" ' 
# '$status $body_bytes_sent "$http_referer" ' 
# '"$http_user_agent" "$http_x_forwarded_for"'; 

access_log logs/access.log; 

server_tokens off; 

sendfile on; 
#tcp_nopush on; 

#keepalive_timeout 0; 
keepalive_timeout 65; 

gzip on; 
gzip_comp_level 3; 
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; 

#HTTP TO HTTPS REDIRECT 
server { 
listen 80; 
server_name myserver.domain.fr; 
return 301 https://$host$request_uri; 
} 

server { 
listen 443 ssl; 
http2 on; 
server_name myserver.domain.fr; 

add_header X-Frame-Options "SAMEORIGIN"; 
add_header X-XSS-Protection "1; mode=block"; 

ssl_certificate "C:/Users/ABC/Desktop/nginx-1.28.0/nginx-1.28.0/certificat/certificate.crt"; 
ssl_certificate_key "C:/Users/ABC/Desktop/nginx-1.28.0/nginx-1.28.0/certificat/private.key"; 

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; 

ssl_ecdh_curve X25519:prime256v1:secp384r1; 
ssl_prefer_server_ciphers off; 

add_header Strict-Transport-Security "max-age=63072000" always; 

# uncomment to enable if ssl_protocols includes TLSv1.2 or earlier; 
# see also ssl_session_ticket_key alternative to stateful session cache 
ssl_session_timeout 1d; 
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions 

ssl_session_tickets on; 

#charset koi8-r; 

access_log logs/access_app.log; 

#location / { 
# root html; 
# index index.html index.htm; 
#} 

location / { 
add_header proxied nginx;
proxy_pass https://mytestserver.domain.fr/ords/r/myworkspace/app_dev/;
} 

#error_page 404 /404.html; 

# redirect server error pages to the static page /50x.html 
# 
error_page 500 502 503 504 /50x.html; 
location = /50x.html { 
root html; 
} 

# deny access to .htaccess files, if Apache's document root 
# concurs with nginx's one 
# 
#location ~ /\.ht { 
# deny all; 
#} 
} 
} 

myserver.domain.fr is declared in local Windows hosts file, pointing to the localhost IP, as my NGINX server is running on localhost.

On the test server, Tomcat is listening on port 443.

When I open my browser locally on my PC, and type myserver.domain.fr I get a too many redirects error.

In can see in tomcat logs that the request is received but the page is looping between login page and page 1.

Hidding the clear URL (with …/ords/r/theworkspacename/app) is a security concern.

Thank you for your light !